Technical Tip: How to remove an interface from SD-WAN zone via CLI

The delete option is available via the command line interface under SD-WAN - Config members.

1. Access the SD-WAN configuration: 

2. Get into the members with the command 'config members': 
    
   FortiGate(sdwan) # config members 
    
3. Delete the interface member with the listed ID:
    
   FortiGate(members) # delete 
   seq-num    Sequence number(1-512).
   1  wan1   SD-WAN Zone   
   2  wan2   SD-WAN Zone   
   3  port1   virtual-wan-link   
    
   FortiGate(members) # delete 3 
   FortiGate(members) # end
   
   
4. After deleting the SD-WAN member, verify the member is properly removed from the configuration:

  show system sdwan

To ensure SD-WAN is functioning correctly after the change, use the following command:

diagnose sys sdwan health-check

In these cases, the following error is seen. Make sure to remove any items where the SD-WAN zone is being referenced first, such as static routes, policies, etc:

To verify a reference object with an SD-WAN interface in the CLI, use the following steps:

diagnose sys cmdb refcnt show <path.object.mkey>

Or:

show full-configuration | grep -f wan1

Example:

diagnose sys cmdb refcnt show system.interface.name wan1
entry used by table system.interface:name 'advpn1'
entry used by table vpn.ipsec.phase1-interface:name 'advpn1'
entry used by child table dstintf:name 'wan1' of table firewall.policy:policyid '1'
entry used by child table dstintf:name 'wan1' of table firewall.policy:policyid '2'
entry used by table router.static:seq-num '1'

Related articles:

Unable to delete SD-WAN Interface - Fortinet Community

Configuring SD-WAN - Fortinet Community